From 0c2ff51d1de3cf312ed73f6f749f575bdb03326f Mon Sep 17 00:00:00 2001 From: John Menke Date: Sun, 1 Nov 2026 14:27:41 -0500 Subject: [PATCH] Fail the deployment check when .env exports a public base URL. An export prefix hid the key, so the checker kept the loopback default and passed. Co-authored-by: Cursor --- src/local_coding_slm/envfile.py | 4 ++-- tests/test_safety.py | 19 +++++++++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/src/local_coding_slm/envfile.py b/src/local_coding_slm/envfile.py index 8f3a78e..7c84f87 100644 --- a/src/local_coding_slm/envfile.py +++ b/src/local_coding_slm/envfile.py @@ -6,7 +6,7 @@ def merge_dotenv(lines: Iterable[str], environ: MutableMapping[str, str]) -> None: - """Apply KEY=value lines. Comments and blanks are ignored. + """Apply KEY=value lines. A leading ``export`` is part of the shell, not the key. A missing key or an empty string is treated as unset so Cursor ``${env:NAME}`` interpolation cannot block a real value from ``.env``. @@ -17,7 +17,7 @@ def merge_dotenv(lines: Iterable[str], environ: MutableMapping[str, str]) -> Non if not line or line.startswith("#") or "=" not in line: continue key, value = line.split("=", 1) - key = key.strip() + key = key.strip().removeprefix("export ").strip() value = value.strip().strip("'").strip('"') if not key: continue diff --git a/tests/test_safety.py b/tests/test_safety.py index 7292c09..dbccba3 100644 --- a/tests/test_safety.py +++ b/tests/test_safety.py @@ -249,6 +249,25 @@ def test_safe_deployment_no_fail(self) -> None: ) self.assertEqual(worst_status(results), "pass") + def test_export_prefixed_base_url_fails(self) -> None: + """A shell export line in .env is still the base URL the checker must see.""" + from local_coding_slm.envfile import merge_dotenv + + environ: dict[str, str] = {} + merge_dotenv( + ["export OLLAMA_BASE_URL=http://8.8.8.8:11434"], + environ, + ) + results = run_checks( + environ=environ, + listen_rows=[("127.0.0.1", 11434)], + tracked=[], + env_ignored=True, + env_example_text="OLLAMA_BASE_URL=http://127.0.0.1:11434\n", + ) + base = next(item for item in results if item.name == "base_url") + self.assertEqual(base.status, "fail", base.message) + def test_git_ls_files_failure_fails_closed(self) -> None: """A failed git listing is not an empty tree with no addresses.""" import subprocess